INCIDENT 2026-09-02 11:05:57 trigger: php_rss=1682MB ================================================================== load: 3.02 2.01 1.85 4/672 2537309 ncpu:10 mem_avail: 6119MB/13777MB (44.4%) swap_used:2394MB swapout:135/s blocked(D):0 running:4 iowait:0.2% steal:0.0% php: 14 procs / 1682MB heaviest user: madalice (10 procs, 1546MB) apache: 58 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3433 madalice 10 1546 nobody 57 1045 root 242 961 mailman 20 304 netdata 7 203 infinium 4 159 cpanellogin 1 97 evolution 8 85 dovenull 6 67 wp-toolkit 3 57 dovecot 3 28 candyfabcom 2 28 zabbix 1 18 lowrange 1 13 kurri 1 13 named 1 11 mailnull 1 9 nscd 1 4 polkitd 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1546 evolution 2 69 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4959 MB Active(file): 4409 MB Inactive(file): 783 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 450 MB CommitLimit: 10984 MB Committed_AS: 9154 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2503909 root 05:56 1212 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 3926885 root 1-08:43:29 5616 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3516336 10.8 Ssl 5-08:46:49 /usr/sbin/mariadbd 706070 655564 root 193412 0.1 S 08:27:59 spamd child 508924 1 netdata 183276 2.0 Ssl 5-08:46:18 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2522462 3929444 madalice 161908 14.6 S 00:55 php-fpm: pool madalice_com_au 2537005 3929444 madalice 160756 28.4 S 00:11 php-fpm: pool madalice_com_au 2536695 3929444 madalice 160732 16.1 S 00:34 php-fpm: pool madalice_com_au 2537006 3929444 madalice 160728 25.9 S 00:11 php-fpm: pool madalice_com_au 2537020 3929444 madalice 160720 24.9 S 00:11 php-fpm: pool madalice_com_au 2537016 3929444 madalice 160696 27.7 S 00:11 php-fpm: pool madalice_com_au 2537009 3929444 madalice 160372 25.6 S 00:11 php-fpm: pool madalice_com_au 2537008 3929444 madalice 160140 36.3 S 00:11 php-fpm: pool madalice_com_au 2537007 3929444 madalice 160044 36.8 S 00:11 php-fpm: pool madalice_com_au 706071 655564 root 151952 0.0 S 08:27:59 spamd child 2537067 3929444 madalice 137752 15.8 S 00:10 php-fpm: pool madalice_com_au 655564 1 root 120044 0.0 Ss 08:42:35 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1911185 1353308 cpanellogin 99876 0.0 S 02:48:04 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2537246 2536668 evolution 62848 41.0 R 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2536989 1353308 infinium 54916 1.1 S 00:12 webmaild - serving 1.41.252.211 2537001 1353308 infinium 54776 1.1 S 00:12 webmaild - serving 1.41.252.211 509236 509098 root 43840 0.0 Sl 5-08:46:15 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 38932 0.1 Ss 42-08:24:41 cpsrvd (SSL) - waiting for connections 1469 1 root 38532 0.1 Ss 65-00:56:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3929420 1 wp-toolkit 37172 0.0 Ss 1-08:43:20 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 2537012 1353308 root 33300 0.0 S 00:11 webmaild - serving 1.41.252.211 2536992 654808 infinium 31320 1.3 S 00:12 php-fpm: pool user_infinium 654927 1 root 28680 0.0 Ss 08:43:06 lfd - sleeping 3929444 1 root 26096 0.0 Ss 1-08:43:20 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 509266 1 root 23592 0.0 Ss 5-08:46:15 /usr/lib/systemd/systemd-journald 2503768 506832 nobody 23380 0.1 S 06:08 /usr/sbin/httpd -k start 2500161 506832 nobody 23340 0.0 S 10:10 /usr/sbin/httpd -k start 2519662 506832 nobody 23024 0.0 S 03:36 /usr/sbin/httpd -k start 2519652 506832 nobody 22944 0.0 S 03:37 /usr/sbin/httpd -k start 2537014 654808 infinium 22772 0.4 S 00:11 php-fpm: pool user_infinium 2519769 506832 nobody 22668 0.0 S 03:30 /usr/sbin/httpd -k start 1463 1 root 22460 0.0 Ss 65-00:56:10 tailwatchd 2520055 506832 nobody 22096 0.1 S 03:06 /usr/sbin/httpd -k start 2520852 506832 nobody 22088 0.0 S 02:11 /usr/sbin/httpd -k start 2520759 506832 nobody 22052 0.0 S 02:13 /usr/sbin/httpd -k start 2521323 506832 nobody 21964 0.0 S 01:42 /usr/sbin/httpd -k start 2503762 506832 nobody 21860 0.0 S 06:08 /usr/sbin/httpd -k start 2518722 506832 nobody 21788 0.0 S 04:57 /usr/sbin/httpd -k start 2518708 506832 nobody 21504 0.0 S 04:58 /usr/sbin/httpd -k start 2521387 506832 nobody 21504 0.0 S 01:41 /usr/sbin/httpd -k start 2519668 506832 nobody 21416 0.0 S 03:36 /usr/sbin/httpd -k start 2519702 506832 nobody 21316 0.1 S 03:32 /usr/sbin/httpd -k start 2521927 506832 nobody 21132 0.1 S 01:12 /usr/sbin/httpd -k start 2521911 506832 nobody 20992 0.0 S 01:13 /usr/sbin/httpd -k start 2521604 506832 nobody 20908 0.1 S 01:29 /usr/sbin/httpd -k start 2521407 506832 nobody 20852 0.0 S 01:40 /usr/sbin/httpd -k start 2521992 506832 nobody 20432 0.0 S 01:11 /usr/sbin/httpd -k start 2522225 506832 nobody 20416 0.0 S 01:02 /usr/sbin/httpd -k start 2520471 506832 nobody 20396 0.0 S 02:39 /usr/sbin/httpd -k start 2518309 506832 nobody 20344 0.0 S 05:27 /usr/sbin/httpd -k start 2521776 506832 nobody 20328 0.0 S 01:21 /usr/sbin/httpd -k start 2536668 506832 nobody 20176 0.1 S 00:35 /usr/sbin/httpd -k start 2520849 506832 nobody 20128 0.0 S 02:11 /usr/sbin/httpd -k start 2537328 2537153 root 20004 0.0 R 00:00 /usr/sbin/exim -q 2520846 506832 nobody 19944 0.1 S 02:11 /usr/sbin/httpd -k start 2520848 506832 nobody 19888 0.0 S 02:11 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 19864 0.0 Ss 1-08:43:19 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 17559370 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 819 evolution/portal.evolutionerp.com.au-ssl_log 355 customc/customcentral.com.au 299 vinesit/vinesit.com.au-ssl_log 214 evolution/app.evolutionerp.com.au-ssl_log 129 madalice/madalice.com.au-ssl_log 20 aaa/aaadownunder.com.au-ssl_log 18 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 648 203.54.180.238 299 130.12.180.117 198 4.205.62.107 170 103.104.165.99 150 182.239.240.254 131 103.104.164.114 129 40.115.94.245 23 124.168.5.234 22 150.228.151.47 16 195.178.110.137 13 165.225.233.87 7 120.150.225.142 5 180.181.236.49 5 147.161.215.96 4 64.31.55.44 --- top request paths across all vhosts (last 3 min) --- 250 POST /functions.php 157 GET /factory_session_checker.php 155 GET /app/ajax.php 79 GET /index.php 79 GET /factory_session_processed_qty.php 79 GET /factory_session_joiner.php 42 GET //app/ajax.php 35 GET /heartbeat.php 34 POST /app/ajax/selectFilterSingle.php 32 POST /plugins/csvexporter/plugin.php 30 POST /clienteditsave.php 26 POST /app/ajax.php 21 POST /quoteditsave.php 18 GET /wp-content/.env 18 GET /wp-admin/.env 18 GET /users/.env 18 GET /test/.env 18 GET /system/.env 18 GET /shop/.env 18 GET /protected/.env --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 250 POST /functions.php 155 GET /app/ajax.php 74 GET /index.php 42 GET //app/ajax.php 34 POST /app/ajax/selectFilterSingle.php 32 POST /plugins/csvexporter/plugin.php 30 POST /clienteditsave.php 26 POST /app/ajax.php 21 POST /quoteditsave.php 13 POST /jobeditsave.php 13 POST /app/ajax/selectFilter.php 12 POST /purchaseaddsave.php -- last 10 requests -- 124.168.5.234 - - [02/Sep/2026:11:05:52 +1000] "POST /plugins/fencecosting/plugin.php HTTP/1.1" 200 93 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=34645" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App 124.168.5.234 - - [02/Sep/2026:11:05:52 +1000] "GET /app/ajax.php?cn=attachmentListSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=13461983597 HTTP/1.1" 200 95 "https://my.evolutionerp.com.au/index. 124.168.5.234 - - [02/Sep/2026:11:05:52 +1000] "GET /app/ajax.php?cn=attachmentThumbSize&furi=true&uri=job&call=getUserSetting&caller=ajaxSubmitLocal&seq=14720176996 HTTP/1.1" 200 96 "https://my.evolutionerp.com.au/index 124.168.5.234 - - [02/Sep/2026:11:05:52 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid34645&call=getUserSetting&caller=ajaxSubmitLocal&seq=17818034105 HTTP/1.1" 200 99 "https://my.evolutionerp.com. 124.168.5.234 - - [02/Sep/2026:11:05:52 +1000] "GET /app/ajax.php?cn=attachmentcategory&furi=true&uri=page%3Dquotedit%26quoteid%3D34645&call=getUserSetting&caller=ajaxSubmitLocal&seq=18033289690 HTTP/1.1" 200 112 "https: 124.168.5.234 - - [02/Sep/2026:11:05:53 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotedit%26quoteid%3D34645&call=getUserSetting&caller=ajaxSubmitLocal&seq=19415485018 HTTP/1.1" 200 101 "https://my.evolutionerp. 124.168.5.234 - - [02/Sep/2026:11:05:53 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=34645" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple 103.104.165.99 - - [02/Sep/2026:11:05:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au/index.php?page=pickingedit&pickingid=16429" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 103.104.165.99 - - [02/Sep/2026:11:05:54 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 236 "https://my.evolutionerp.com.au/index.php?page=clientlist" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 124.168.5.234 - - [02/Sep/2026:11:05:54 +1000] "POST /app/ajax/selectFilterSingle.php HTTP/1.1" 200 21191 "https://my.evolutionerp.com.au/index.php?page=quotedit"eid=34645" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 157 GET /factory_session_checker.php 79 GET /factory_session_processed_qty.php 79 GET /factory_session_joiner.php 35 GET /heartbeat.php 5 GET /index.php -- last 10 requests -- 203.54.180.238 - - [02/Sep/2026:11:05:51 +1000] "GET /factory_session_joiner.php?id=35027 HTTP/1.1" 200 78 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:11:05:52 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 126 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:11:05:52 +1000] "GET /factory_session_joiner.php?id=35035 HTTP/1.1" 200 112 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleW 203.54.180.238 - - [02/Sep/2026:11:05:53 +1000] "GET /heartbeat.php?sentAt=1788311153&bytes=106,151,118,113&_=1788310892782 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=9 203.54.180.238 - - [02/Sep/2026:11:05:54 +1000] "GET /factory_session_joiner.php?id=35041 HTTP/1.1" 200 79 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWe 203.54.180.238 - - [02/Sep/2026:11:05:54 +1000] "GET /factory_session_processed_qty.php HTTP/1.1" 200 127 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWeb 203.54.180.238 - - [02/Sep/2026:11:05:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:11:05:54 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:11:05:55 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 203.54.180.238 - - [02/Sep/2026:11:05:55 +1000] "GET /factory_session_checker.php HTTP/1.1" 200 35 "https://portal.evolutionerp.com.au/index.php?page=factory_workbench" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537 == customc/customcentral.com.au == -- top paths -- 18 GET /wp-content/.env 18 GET /wp-admin/.env 18 GET /users/.env 18 GET /test/.env 18 GET /system/.env 18 GET /shop/.env 18 GET /protected/.env 18 GET /portal/.env 18 GET /html/.env 18 GET /dashboard/.env 18 GET /core/.env 18 GET /account/.env -- last 10 requests -- 130.12.180.117 - - [02/Sep/2026:11:05:47 +1000] "GET /users/.env HTTP/1.1" 301 290 "https://customcentral.com.au:80/users/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yoko 130.12.180.117 - - [02/Sep/2026:11:05:47 +1000] "GET /login/.env HTTP/1.1" 301 295 "https://mail.customcentral.com.au:80/login/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, 130.12.180.117 - - [02/Sep/2026:11:05:48 +1000] "GET /users/.env HTTP/1.1" 301 290 "https://customcentral.com.au:80/users/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yoko 130.12.180.117 - - [02/Sep/2026:11:05:48 +1000] "GET /login/.env HTTP/1.1" 301 295 "https://mail.customcentral.com.au:80/login/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, 130.12.180.117 - - [02/Sep/2026:11:05:50 +1000] "GET /users/.env HTTP/1.1" 301 290 "https://customcentral.com.au:80/users/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yoko 130.12.180.117 - - [02/Sep/2026:11:05:50 +1000] "GET //apps/.env HTTP/1.1" 301 294 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security h 130.12.180.117 - - [02/Sep/2026:11:05:53 +1000] "GET /apps/.env HTTP/1.1" 301 294 "http://mail.customcentral.com.au:80//apps/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Y 130.12.180.117 - - [02/Sep/2026:11:05:53 +1000] "GET /users/.env HTTP/1.1" 301 290 "https://customcentral.com.au:80/users/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yoko 130.12.180.117 - - [02/Sep/2026:11:05:54 +1000] "GET //login/.env HTTP/1.1" 301 290 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security 130.12.180.117 - - [02/Sep/2026:11:05:54 +1000] "GET /apps/.env HTTP/1.1" 301 294 "https://mail.customcentral.com.au:80/apps/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Y --- last 30 samples (run-up to this incident) --- 2026-09-02 11:03:36 L1=1.42 run=3 blk=0 avail=7430 (53.9%) swpO=0 conn=2 myRSS=3436 php=6 phpRSS=394 ap=41 tcp=43 topuser=madalice 2026-09-02 11:03:36 L1=1.42 run=4 blk=0 avail=7430 (53.9%) swpO=0 conn=4 myRSS=3436 php=6 phpRSS=394 ap=41 tcp=43 topuser=madalice 2026-09-02 11:03:46 L1=1.35 run=2 blk=0 avail=7370 (53.5%) swpO=0 conn=4 myRSS=3436 php=5 phpRSS=336 ap=52 tcp=67 topuser=madalice 2026-09-02 11:03:46 L1=1.35 run=2 blk=0 avail=7370 (53.5%) swpO=0 conn=2 myRSS=3436 php=5 phpRSS=334 ap=52 tcp=67 topuser=madalice 2026-09-02 11:03:56 L1=1.31 run=4 blk=0 avail=7232 (52.5%) swpO=0 conn=4 myRSS=3436 php=8 phpRSS=500 ap=60 tcp=66 topuser=madalice 2026-09-02 11:03:56 L1=1.31 run=4 blk=0 avail=7232 (52.5%) swpO=0 conn=3 myRSS=3436 php=8 phpRSS=500 ap=60 tcp=66 topuser=madalice 2026-09-02 11:04:06 L1=1.34 run=2 blk=0 avail=7419 (53.8%) swpO=0 conn=4 myRSS=3437 php=4 phpRSS=257 ap=53 tcp=53 topuser=madalice 2026-09-02 11:04:06 L1=1.34 run=6 blk=0 avail=7418 (53.8%) swpO=0 conn=3 myRSS=3437 php=4 phpRSS=257 ap=53 tcp=53 topuser=madalice 2026-09-02 11:04:16 L1=1.28 run=4 blk=0 avail=7444 (54.0%) swpO=0 conn=4 myRSS=3437 php=6 phpRSS=330 ap=46 tcp=60 topuser=madalice 2026-09-02 11:04:16 L1=1.28 run=7 blk=0 avail=7438 (54.0%) swpO=0 conn=3 myRSS=3437 php=7 phpRSS=372 ap=46 tcp=62 topuser=evolution 2026-09-02 11:04:26 L1=1.38 run=4 blk=0 avail=7332 (53.2%) swpO=0 conn=3 myRSS=3437 php=6 phpRSS=414 ap=49 tcp=58 topuser=madalice 2026-09-02 11:04:26 L1=1.38 run=2 blk=0 avail=7333 (53.2%) swpO=0 conn=2 myRSS=3437 php=5 phpRSS=392 ap=49 tcp=58 topuser=madalice 2026-09-02 11:04:36 L1=1.57 run=7 blk=0 avail=7283 (52.9%) swpO=0 conn=2 myRSS=3437 php=7 phpRSS=499 ap=49 tcp=60 topuser=madalice 2026-09-02 11:04:36 L1=1.57 run=8 blk=0 avail=7287 (52.9%) swpO=0 conn=3 myRSS=3437 php=7 phpRSS=499 ap=49 tcp=60 topuser=madalice 2026-09-02 11:04:46 L1=1.77 run=8 blk=0 avail=7305 (53.0%) swpO=0 conn=2 myRSS=3437 php=6 phpRSS=415 ap=53 tcp=66 topuser=madalice 2026-09-02 11:04:46 L1=1.77 run=8 blk=0 avail=7304 (53.0%) swpO=0 conn=3 myRSS=3437 php=6 phpRSS=415 ap=53 tcp=68 topuser=madalice 2026-09-02 11:04:56 L1=2.16 run=5 blk=0 avail=7366 (53.5%) swpO=0 conn=2 myRSS=3437 php=5 phpRSS=334 ap=53 tcp=58 topuser=madalice 2026-09-02 11:04:56 L1=2.16 run=5 blk=0 avail=7362 (53.4%) swpO=0 conn=2 myRSS=3437 php=5 phpRSS=324 ap=53 tcp=58 topuser=madalice 2026-09-02 11:05:07 L1=2.54 run=12 blk=0 avail=7242 (52.6%) swpO=0 conn=2 myRSS=3437 php=6 phpRSS=456 ap=49 tcp=60 topuser=madalice 2026-09-02 11:05:07 L1=2.54 run=9 blk=0 avail=7243 (52.6%) swpO=0 conn=2 myRSS=3437 php=6 phpRSS=436 ap=49 tcp=60 topuser=madalice 2026-09-02 11:05:17 L1=2.77 run=6 blk=0 avail=7398 (53.7%) swpO=0 conn=2 myRSS=3437 php=4 phpRSS=282 ap=48 tcp=58 topuser=madalice 2026-09-02 11:05:17 L1=2.77 run=7 blk=0 avail=7398 (53.7%) swpO=0 conn=2 myRSS=3437 php=4 phpRSS=282 ap=48 tcp=58 topuser=madalice 2026-09-02 11:05:27 L1=2.81 run=3 blk=0 avail=7184 (52.1%) swpO=0 conn=2 myRSS=3437 php=5 phpRSS=458 ap=61 tcp=57 topuser=madalice 2026-09-02 11:05:27 L1=2.81 run=3 blk=0 avail=7184 (52.1%) swpO=0 conn=1 myRSS=3437 php=5 phpRSS=458 ap=61 tcp=57 topuser=madalice 2026-09-02 11:05:37 L1=2.53 run=7 blk=0 avail=7318 (53.1%) swpO=0 conn=1 myRSS=3437 php=6 phpRSS=430 ap=50 tcp=45 topuser=madalice 2026-09-02 11:05:37 L1=2.53 run=6 blk=0 avail=7318 (53.1%) swpO=0 conn=2 myRSS=3437 php=6 phpRSS=430 ap=50 tcp=45 topuser=madalice 2026-09-02 11:05:47 L1=2.94 run=13 blk=0 avail=6686 (48.5%) swpO=0 conn=2 myRSS=3437 php=12 phpRSS=1106 ap=47 tcp=67 topuser=madalice 2026-09-02 11:05:47 L1=2.94 run=15 blk=0 avail=6664 (48.4%) swpO=0 conn=1 myRSS=3436 php=11 phpRSS=1163 ap=47 tcp=67 topuser=madalice 2026-09-02 11:05:57 L1=3.02 run=4 blk=0 avail=6119 (44.4%) swpO=135 conn=1 myRSS=3433 php=14 phpRSS=1682 ap=58 tcp=50 topuser=madalice 2026-09-02 11:05:57 L1=3.02 run=2 blk=0 avail=6136 (44.5%) swpO=135 conn=1 myRSS=3433 php=13 phpRSS=1641 ap=58 tcp=49 topuser=madalice